add -cert_chain option to s_client